JWT Issuer Configuration#

oauth2-proxy supports validating JWT bearer tokens from multiple issuers via --skip-jwt-bearer-tokens and --extra-jwt-issuers. When --skip-jwt-bearer-tokens is enabled, requests bearing a verified JWT are passed through without redirecting to the OAuth flow. Extra issuers beyond the primary provider are registered at startup using --extra-jwt-issuers (cfg: extra_jwt_issuers, env: OAUTH2_PROXY_EXTRA_JWT_ISSUERS) 1.

Configuration Format#

Each entry in --extra-jwt-issuers is a string of the form issuer_url=audience 2:

--extra-jwt-issuers=https://accounts.google.com=my-client-id

parseJwtIssuers splits on =, treating everything after the first = as the audience (allowing = in the audience value) 3. This produces a jwtIssuer struct with issuerURI and audience fields 4.

How Verifiers Are Constructed (newVerifierFromJwtIssuer)#

newVerifierFromJwtIssuer builds a ProviderVerifier for each parsed issuer using a minimal ProviderVerifierOptions — only four fields are set 5:

Notable omissions: SupportedSigningAlgs, SkipIssuerVerification, PublicKeyFiles, and JWKsURL are never set by newVerifierFromJwtIssuer. The SupportedSigningAlgs field on ProviderVerifierOptions exists and is threaded through to oidc.Config 6 — but because it is not populated here, any --oidc-enabled-signing-algs restriction configured for the primary provider is silently ignored for extra issuers.

Discovery with automatic fallback: The function first attempts OIDC discovery via NewProviderVerifier 7. If that fails, it retries with SkipDiscovery=true and a hard-coded fallback JWKS URL of <issuerURI>/.well-known/jwks.json 8. There is no way to supply a custom JWKS URL for an extra issuer.

Limitations#

1. No signing algorithm restrictions. SupportedSigningAlgs is never set for extra issuers. The intersectSigningAlgs intersection logic that enforces --oidc-enabled-signing-algs against the primary provider's discovery document 9 is bypassed entirely.

2. Hard-coded JWKS fallback path. The fallback JWKS URL is always <issuerURI>/.well-known/jwks.json 10. Issuers that host JWKS at a different path require a working OIDC discovery endpoint.

3. No custom CA / TLS options. ProviderVerifierOptions for extra issuers shares the global HTTP transport; there is no per-issuer CA or TLS override.

4. No SkipIssuerVerification. By default the ID token iss claim must exactly match the configured IssuerURL; the --insecure-oidc-skip-issuer-verification flag only applies to the primary provider.

5. Audience from first provider's config only. AudienceClaims and ExtraAudiences are always taken from Providers[0] 11, not configurable per-issuer.

Key Source Files#